Securing image URLs in a website

How to hide image URLs on a website to avoid illegal access, using a custom HttpHandler and encryption.

Introduction

Recently, I started work on a medical image server for a hospital. Clearly, in such a context, security is very important. Because I had to authenticate users using some 3rd party components that are integrated into the HIS (hospital information system), Windows authentication was out of the question. This meant I could not use NTFS permissions to secure the actual image files. Form based authentication is possible, but does not solve my problem of someone typing in the URL of a patient's image directly. For simplicity, I stuck with anonymous IIS authentication, and a login form that created a session ticket which could be checked on every page. Again, this does not solve the problem of direct image access using URLs. However, I found some interesting articles about custom HTTP handlers on the MSDN site. This alone actually WORSENS the problem as it allows a user to actually gain access to images on the whole file system of the web server, but together with symmetric encryption (again from articles on the net), a secure system can be setup!

Taking the images out of the website

In order to avoid somebody typing in URLs to gain illegal access to images, we have to take them out of the website if we cannot rely on file permissions. In order to still be able to access those files, we will setup a custom HTTP handler (also check out Microsoft support and more specifically MSDN). This last article looked exactly what I needed, so I implemented it. Please read it for details.

The page ShowImage.axd is a dummy endpoint, it doesn't actually exist. The type tag points to a class in my namespace ImageServer, which I will list further. HTML image elements now looked something like:

Encryption

However, to my amazement, this method actually allows a user to download an image file from anywhere in the file system of the server. Indeed, I dumped an image test.jpg in C:\temp\ on the server, typed in the URL "ShowImage.axd?Path=C:\temp\test.jpg" in IE, and PRESTO, it showed the test image! Clearly not an improvement, even if it can be solved with extra coding in the handler and NTFS permissions ...

After some reflection, I decided to use symmetric encryption to make the Path querystring unreadable on the client, thereby hiding any details about the location of my images on the server. This also avoids users trying to type in random paths, as the chance that a valid path results after decryption is very, very small. So the procedure goes as follows:

Generate a key when a user logs on and store it in the session object.

Encrypt any path querystring in the ASP.NET pages using that key.

Decrypt the path querystring in the StreamImageHttpHandler class associated with the ShowImage.axd endpoint.

Some of the overloaded methods take into account that the personal symmetric key of a user is stored in the session object. Note that the querystring becomes almost twice as long because of the 2 byte per characters.

Conclusion

We have presented a way to hide the URLs of images from any access outside that permitted by the security logic inside the aspx pages: no URLs in the HTML source code anymore, and no direct typing in of URLs either.

caching is indeed turned off for most pages (this also allows me to implement proper 'backspace' navigation because all my pages are dynamic and change all the time). This does of course mean a penalty hit, but in practise this is not a problem so far. I have apps running both in intranet and internet environments with large images (6-8 MPixel) and it works just fine. The only thing which is sometimes troublesome is when a proxy - antivirus - firewall combinations is used for surfing on the internet. Such a combo is hit twice as hard when not caching ...